SQLite versions earlier than 3.53.2 contain a heap‑based buffer overflow in the FTS5 full‑text search extension. A crafted database can include malformed continuation page metadata that specifies a szLeaf value smaller than four bytes. When the database engine processes a MATCH query, the fts5ChunkIterate function triggers an integer underflow, inflating a remaining byte count and causing a buffer overflow on the heap. The overflow can lead to a crash or, if exploited successfully, arbitrary code execution within the host process.

The vulnerability affects the SQLite library itself, specifically builds compiled with the SQLITE_ENABLE_FTS5 option. All releases before version 3.53.2 are susceptible to the flaw. Applications that embed SQLite in this configuration should consider the affected operating environment.

The CVSS score of 8.5 categorizes this flaw as high severity, and while EPSS information is not available, the lack of a KEV listing does not diminish the risk to systems that use the vulnerable SQLite builds. Attackers can exploit the flaw by delivering a malicious database file to an application that processes FTS5 queries, making it an offline or local compromise vector. Successful exploitation could enable the attacker to control code execution, causing loss of confidentiality, integrity, and availability of affected systems.